The operational constraint is tenant isolation, not the headline storage rate. For a customer-support system accepting private user documents, I would start with AWS S3 when global redundancy, mature controls, and a broad compliance posture justify the premium. I would choose Wasabi for long-lived, infrequently accessed documents, and Backblaze B2 when the application reads gigabytes often or the project budget is mid-scale.

Short answer: make every object key tenant-scoped, keep download authorization in the application, and issue links that expire. Then choose the backend whose failure modes fit the access pattern. A cheap bucket with weak recovery semantics is a poor trade if one tenant can read another tenant's attachment.

What does tenant isolation require from object storage?

I model the key as an authorization boundary, not as a filename.…